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Dear Madam/Sir, 


We, the European Gaming and Betting Association (EGBA), the representative body of European Union 
regulated and licensed online gaming operators, would like to hereby share our point of view on the 
UK Government consultation on the transposition of the Fourth Anti-Money Laundering Directive 
(hereinafter “4 AMLD”). 





We would like to begin by congratulating the UK Government on what we assess as an overall positive 
and workable implementation of the 4° AMLD. With that being said, EGBA would, however, like to 
offer our thoughts on several questions of the consultation and specifically covering Chapter 5 thereof. 
We also have a few comments on some of the broader issues that are raised elsewhere in the paper. 


1. Responses to consultation questions on gambling providers 


Question 26: Do you think that the government should consider exempting proven low risk providers of 
gambling services from the Regulations based on the gambling activity or by a complete sector (see the 
list at paragraph 5.8 or Annex C for information on how the sectors are split up) or both? Please explain 
the reasons behind your response. 


We would first like to point out that in our view, online gaming and online betting do not present high 
risk in terms of money laundering. This view has been shared by the European Commission, which has 
stated the following: 


“As for money laundering, there is currently very limited information or evidence suggesting that 
licensed online gambling operators in Europe are subject to money laundering activities. The prevailing 
problem is linked to unregulated operators who are offering their services at a distance from outside 
of the EU with either no or a very low degree of regulation and supervision.” 


Furthermore, already in 2009, a study carried out by Professor Levi, from the University of Cardiff, 
found that: 


“There is much mythology about e-gaming laundering risks, fed by inadequate information and 
a tendency to project a dislike of gaming and/or private sector involvement in it into alarm 
about e-crime in general and the role of gaming in this.” 


- “In short, compared to methods of customer identification and monitoring in the off-line 
gaming and financial services sector, the scope for substantial abuse of e-gaming for 
laundering purposes is modest, both for those crimes that generate cash and for those that do 
not.”? 


This is due to the traceability of all gambling activities and transactions carried out by private operators. 
This transparency is for instance ensured by the recording and tracking of customer transactions by 
the operators. 


In particular, paragraphs below describe part of the direct and pro-active strategy undertaken by our 
members. This strategy involves comprehensive and continuous mitigation work on the industry risk- 
factors, with particular efforts around: 


° Transactions: entirely cash-free transaction system integrated with the highly regulated EU 
financial services providers; 


° Visibility: complete lack of customer anonymity, where gambling CDD processes are 
personalised in line with the accounts themselves 


° Closed loop: it must be shown that the costumer owns any financial instrument used to 
deposit/withdraw money. 


° Audited Internal Control Systems: operators employ advanced Internal Control Systems (“ICS”) 
built on a risk-based approach and the flagging of suspicious activity for further enhanced customer 
due diligence. Measures such as deposit blocks and account suspensions are taken when deemed 
necessary. 


° Accountability: online gambling operators use cutting-edge technology processes and routine 
operations which are inherently highly traceable and easily audited (i.e. digital fingerprints, tracking of 
detailed customer action trail from log-in to log-out). 


t http://ec.europa.eu/internal_market/gambling/docs/121023_online-gambling-staff-working-paper_en.pdf 
2 Money Laundering Risks and E-Gaming: A European Overview and Assessment, Final Report, 

Michael Levi, Ph.D., D.Sc. (Econ.), p. 6. Available at: 
http://www.egba.eu/pdf/Levi_Final_Money_Laundering_Risks_egaming%20280909.pdf 

3 Ibidem, p. 26. 


Moreover, national legislation imposes severe Know-Your-Costumer (KYC) requirements on online 
operators. These requirements aim at the verification of the identity of players, and oblige online 
gambling operators to request and verify a number of documents to each of their players.* 


While casinos remain part of the regulated sector, we are not seeking any exemption for a specific 
sector. As a matter of fact, our members do not make any differentiation in procedures between the 
provision of online gaming and online betting products but apply appropriate AML procedures to all of 
these products equally. Such a choice is justified also by practical reasons: when offering a wide range 
of both online gaming and online betting products, allowing customers to use funds in their single 
wallets to gamble on all products is easier and it would be sensible to assess risk by sector rather than 
by specific gambling activity. 


, 


Question 27: Which gambling providers or activities do you think should be classified as having ‘proven 
low risk and therefore should be exempt from the Regulations? Please provide credible, cogent and 
open-source evidence to support your response. 


While we are not in a position to advise on that question, we would like to offer some general 
observations. Licence requirements established by each national regulator set rules for combatting 
money laundering. Nowadays most online gambling operators are cross-border and hold multiple 
licenses in multiple jurisdictions, therefore they are obliged to comply with a large number of AML 
rules. As a standard, EU -licensed and regulated- online gambling providers, due to the nature of the 
online service and in order to comply with the 4th AMLD, fraud prevention and responsible gaming 
standards, do not operate with cash but rather through highly regulated financial institutions, adding 
an additional layer of security to their processes. This is an example on why it is also preferable to only 
allow payment methods which are offered by PSPs licensed in the EU/EEA — which is actually a licensing 
requirement in most licensing jurisdictions-, in order to ensure an additional level of supervision. 


Please find here below a table including information from one of our members on the payment 
methods used by customers to make a deposit: 


Deposit methods Split per frequency Split per amount 


Bank 0.1% 0.5% 
Cards 49.1% 51.1% 

eWallet 2.5% 7.8% 
Instant 42.5% 37.2% 

Prepaid 5.8% 3.3% 
Grand Total f 100.0% 100.0% 


Further, it should be reminded that gambling transactions over the internet are traceable, recorded 
and transparent due to the digital footprint (presenting fewer risks than cash payments or face-to-face 
identification) and hence offer far more possibilities to detect and prosecute fraudulent activities than 
offline transactions. The online gambling operators also rely on bank and payment accounts where the 
customer may already be identified and submitted to basic CDD. 


Moreover, risk of gambling-related money-laundering is becoming even lower due to action taken in 
the field of electronic verification by EU and national regulators, and by private operators. 


4 For an extensive explanation of the KYC process please see EGBA’s Online Gambling Regulation Manual, 24 
May 2016, 3rd Edition, pages 4-9. 


In what concerns the public sector, initiatives are being taken in order to improve/harmonize 
electronic identification systems and procedures. These initiatives include for instance, the elDAS 
Regulation,” or the issuing of e-ID cards by some Member States such as Spain, Estonia and Belgium. 


Regarding the private sector, companies more and more are launching identity verification services. 
Examples of that are BankID° in the Nordics or weblD.’ 


Moreover, it is worth mentioning that consumer trust is a key asset for online gambling operators, 
which seek to be distinguished by consumers in what relates to, inter alia, gambling-related crime 
prevention. Most consumers are reluctant to play with operators believed to be linked with criminal 
or terrorist organizations. For this reason, private operators have also put in place developed initiatives 
to bring the fight against fraud one step beyond. 


For instance, the CEN Workshop Agreement on responsible remote gambling measures (2011) obliges 
EU regulated operators to constantly monitor and report suspicious transactions to the relevant 


authorities. The CEN Workshop Agreement, which includes more than one hundred measures dealing 
mostly with consumer protection and fraud and gambling-related crime prevention, is based on a 
recommendation on online gambling issued by the European Commission on 2014.8 


On the contrary, the use of cash by land-based gambling activities does not require any registration or 
customer identification, leading some users to turn away from easily traceable digital payment 
options. 


Question 28: Should CDD requirements for the gambling providers or activities take place: (i) on the 
wagering of a stake; (ii) on the collection of winnings; (iii) on the collection of winnings and the 
wagering of a stake; or (iv) or whichever is the latter? Please explain the reasons behind your response. 


Firstly, EGBA would appreciate from the Gambling Commission to define the terms “wagering a stake” 
and “collection of winnings”. Our definition of the terms reads as follows: “wagering of a stake” means 
depositing money, as customers usually have to wager their money before they make a withdrawal; 
and “collection of winnings” means withdrawals from the gambling wallet to the customers preferred 
payment method. We also would like to highlight that when defining those terms, it would be sensible 
from the Gambling Commission to link the criteria to a time period. EGBA recommends that only real 
cash flows should be considered, when determining at what point of time a customer has reached the 
EUR 2000 threshold giving rise to the CDD process. Therefore, in our view, the best would be that the 
CDD process takes place when real money transactions take place on the gambling operators’ wallet. 


In our view, the aim of the CDD process is to mitigate the risks of fraud and money-laundering, 
consisting of two main steps: (i) obtaining information from the player and (ii) verifying the accuracy 
of the information provided. It requires information such as name, date of birth, photo, address, 
contacts and national ID number. Afterwards, the operator will verify this information by using 
different methods, depending on each national legislation. 


5 Regulation (EU) No 910/2014 of the European Parliament and of the Council of 23 July 2014 on electronic 
identification and trust services for electronic transactions in the internal market and repealing Directive 
1999/93/EC 

€ https://www.bankid.com/en/ 

7 https://www.webid-solutions.de/en/ 

8 Commission Recommendation of 14 July 2014 on principles for the protection of consumers and players of 
online gambling services and for the prevention of minors from gambling online, 2014/478/EU. (“EC 2014 
Recommendation”). 


The most commonly used method, which is also recommended by the European Commission,’ is a 
temporary grace period in which verification needs to be completed, but during in which the player is 
allowed to play. A 30-day temporary account allows players to deposit money and play but not to 
withdraw any money, which is only possible after the completion of the CDD Process. If the player fails 
to successfully prove his/her information, the temporary account will be automatically closed. An 
alternative method would be to conduct verification once a player has reached a threshold (risk-based 
approach). 


More generally, two important facts need to be taken into consideration. 


The first of them is that CDD measures involve the processing of a significant amount of personal data. 
In that regard and as stated in the 4* AMLD, CDD requirements must comply with Directive 95/46/EC 
(“Data Protection Directive”), and must observe the right to the protection of personal data of 
potential players. 


The second of them is that customer experience in any e-commerce sector, such as online gambling, 
plays a crucial role in channelling the demand towards the regulated offer. It is therefore, also with 
regard to Anti-Money laundering measures, crucial to take into account that the demand needs to be 
channelled towards the regulated offer. Therefore, the CDD process should be convenient from a 
player’s perspective, without being too burdensome, something that has been acknowledged by the 
European Commission.*? Otherwise, more and more the demand for online gambling services will be 
channelled towards the unregulated offer. 


In any event, when designing CDD requirements it must be born in mind that operators are 
continuously having to balance and navigate through risk of conflicting legal obligation (i.e. data 
protection), operational feasibility (legislation against what is technically and operationally possible 
and financially sustainably feasible). In this respect, EGBA members always welcome clear guidance on 
when operators can discharge their obligations under AML notably in light of tipping off considering 
the lack thereof and minimal case law HSBC v. Shah [2012]. 


Finally, EGBA would like to ask that, as recommended by the European Commission, national 
authorities facilitate online gambling operators access to “national registers, databases or other official 
documents against which operators should verify the identity details” .° 


Question 29: What do you think constitutes a ‘linked transaction’ for different types of gambling? Do 
you think ‘linked transaction’ should be defined in legislation? 


Standard practice is that in online gambling the linked transactions would normally be real money 
transactions on the customers gambling wallet (deposits and withdrawals) from the opening of the 
gambling account. In that way, it means that gambling operators have to verify customers who reach 
the threshold of EUR 2000 over an unlimited time period. 


Further, it would be helpful if the Gambling Commission could give its wording of “linked transactions” 
and determine a time period when transactions have to be considered “linked”. 


° EC 2014 Recommendation, paragraph 22. 
10 Data Protection Directive, Article 41(1). 
1 Data Protection Directive, Recital 65. 

12 EC 2014 Recommendation, paragraph 21. 
13 EC 2014 Recommendation, paragraph 18. 


Question 30: If covered by the Regulations, what costs and impacts would be incurred by the providers 
of the gambling services? Please provide sources for your data and suitable evidence. In particular, the 
government is keen to know what your initial transition costs would be, how much you would need to 
spend on staff training and how much it would cost to apply CDD measures. 


Due to the fact that the 4° AMLD is a directive, is implementation into national law leads to duplication. 
Any harmonization would be likely to increase efficiency and reduce costs. 


However, we do not believe that the extension of the Anti-Money laundering regime to online betting 
would incur significant costs, especially due to the fact that in practice, operators’ approach towards 
online betting already takes into account the Anti-Money laundering legislation and applies its rules. 
Moreover, under the current requirements of the Proceeds of Crime Act 2002, many of the money 
laundering requirements are already satisfied in online betting operations. 


In general, remote operators make high levels of financial and resource investments to supporting 
strong compliance and monitoring functions. (e.g. for 2017, an EGBA member alone will spend 
+20mEUR and 150 FTEs across the line organisation with a primary control and compliance role.) 


This is due to stringent regulation that applies to the online gambling sector and to the fact that, as 
stated above, consumer trust is a key asset for online gambling operators; therefore, operators make 
substantial investments in order to avoid to be involved in any financial scandal. One EGBA member 
has disclosed that for the full year 2016 it estimates that it will have submitted around two hundred 
SARs. The same EGBA member manually verifies around 25,000 withdrawals every week, which 
corresponds to roughly 30% of total withdrawals. Furthermore; this member states that it through its 
internal risk reports de-risks approximately 35% of the internal risk reports escalated to the MLRO. 


Question 31: What advantages would there be for increasing the coverage of the Regulations to more 
than just casinos in the gambling industry? 


It would be wise to await the results of the European Commission’s supranational risk assessment 
before any decisions are taken on this point. 


Question 32: Do you believe that measures could be taken by the Gambling Commission under the Act 
that might have a bearing on whether you view a sector or activity as being proven low risk? 


It would be useful to be acquainted with the methodology that the UK Government has used to assess 
proven low risk in the national risk assessment to be able to fully answer that question. Still, it should 
be reminded that any exemption needs to be proven with actual and factual evidence to demonstrate 
the absence of risk in a concrete manner. 


2. Other comments 


PEPs and members of international sporting federations (page 41 and Question 58 


The proposal to extend the definition of Politically Exposed Persons (PEPs) to those in a position of 
influence in international sporting bodies (ISF) may need to be carefully considered. In that regard, 
One EGBA member, has already had advanced discussions favouring a PEP based system for athletes 
to complement the existing process. 


3. Conclusion 


In conclusion, while we acknowledge the existence of certain risks related to the digital character of 
online gambling (i.e. no face-to-face contact), we strongly believe that these risks can be mitigated to 
great satisfaction so that the overall risk for online gambling turns out to be actually lower than retail 
gambling where use of cash, anonymity and lack no audit trail are unavoidable risk-factors. 
Accordingly, remote operators are adopting BigData, CustomerAnalytics, digital fingerprinting and e- 
ID solutions as exclusive use of new technology to mitigate inherent risks. 


Yours sincerely, 
Va 
Va 
Maarten Haijer 


Secretary General 


